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mm&] mmm 

mm<?>£ffl m^y^-^v=L^mm.mm^m 

(-1) mod N&tfIt§»^oT, *<D%mz. 

(1) S 1 = A*B*R* (-1) mod N $rit3S"f"-S^:r v y 

(2) (1) ©ft*) »J ICS 2 = {sN + A«(-l)*f } * (tN + B*(-l)"g} 
R (-1). mod N (s, t, f, gl*4>fc< fc% 1 oteO-?fc^JS»*e 

■&»;, f , gftoxtti) &tn*f s*^:/, 

(3) _tfa (l) i: (2) <i>\^M^m&m$K1rz>7s7-y?^ 

(4) ±Sa (1) (2) (3) &ail[itt»j3gL, *«lC_fciH (1) &38#Lfcfc 
#JCtt#f#je^S 1 tC^V^TT 1 = S x * R * (-1) modN^ILTT^ 

ffiiju, _tta (2) &ja^ofcfc#KtttfiMejiis 2 icov^T 2 = s 2 * r a ( 

-1) modN^ItlLTN-T^mS^fy^ £<}:tf 

(5) T^N-Tgfc, 0f#ra©0J^m^A * B * R " (-1) mod N (D 

^ lata (3) (Z)j&1:»^3£«, a»&MvxTV^;ftfr&&m-S 

fcf Stl 1 3B«0>W * >/\°-=E ^ 9tB3MQ.Jl;£8i„ 

lata (s, t, f , g) (o, i, o, i )T°&zz.£. zftm.£-tzm#m 
i mmnm* y^-^v^^mMmm^m, 

tffga ( s , t , f , g) ^ ( i , o , i , o)t'fe5ii:&#tttsi^ 
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(1) S=A*B mod pS:tf»tS^f«;^' 

(2) (1) ©fSfc>UJCS= {sp + A*(-l)*f } * {tp + B*(-l)"g} mo 
dp (s, t, f, gl$'p&< l-DitOV&^mmV&V. f, giZOX 

6 i -e f + g &mm ztm-tzxrv?. 

(3) _LfH (1) i: (2) ©v^;ft;fr£^:i^R-3-£X5 1 y:A 

(4) ±sa (i) £ (2) <D?%mnzfttt<Dtmffi^s*m^&m<Dffl&m 

HA * B mod p©ft|L^i:btMv^^T7^$:^t5i^l:#ti:t5 
if # > A - ^ a. MH^L 

mm (s , t , f , g) tt, (1 , 1 , 1 , l)T'&£^£:£#^i:t-£f»:£« 
5 SE«©» # > A - ^ S>a. ^iSUMaa^ss. 

grflH (2) ®Xf^©f + g(ifMot, ffrfB (4) ©ftfryfc:, 

(4) tufa (l) &»#Lfci:£fcmiMg*S*©3^i:U fata (2) &3gft 

(5) UffBS i: p - S &, m^Mm<Dffl&ffkW.A*B mod p©ttI^i:L 
Tffl Vx£*^ V -71tmir& Z. H SIM 5 fa«tf>lf # > A-^E V=L=y 

ffffH (s , t , f , g) ft, (0 , 1 , 0 , l)T*&S;i££#^£ir5iii:£:g 

7 fE«(Z>© * > A° - ^ *; a. ^ illM^S. 

mmmmmmzmmisT. m^mm^izmm^^m^mnv$>^A (x) *b 

(x) mod * (x) (<I>(x) ttx©ffij|!Sj#^^T?&y; A (x) *B (x 
) ©«8i«)SI*tt3«±G)3R»pS:2Si:UTffe>) &ftIt5»^ot, f 

(1) S (x) = A (x) * B (x) mod <D (x) fcffaffS ^ y ^, 

(2) (1) CDftfcytCS (x) = {s<D(x) + A (x) *(-!)"£ } * {t 
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* (x) + B (x) *(-l)'g} mod <D (x) (s, t, f, g&4>fc<£: 

(3) _tfB (i) t (2) ©vx-rn^ftaucja^-rsx^^^ 

(4) ±ih (i) a: (2) <D$iE>mmziML%<Dtf&i£ms (x) Ht-t&s 

<Dffl&m%A (x) *B (x) mod $ (x) ©ftH^H£ LT JB^-SX^y 
[19*^10] 

IrffHCs, t, f, g) tt, (1,1,1, l)T*&£Z.HZ<8ffi£.'t2>M&m 
iSIB (2) <D^yzf<D f ■+ gteWt&T'&oT, f&ia (4) (DfSfcUlC 

(4) tffiB (i) zmMLfctgmmm&s (x) u _tta (2) 

&3B#ll/fcfc£JCW:S (x) ©ftfcyic* (x) -S (x) *tm%ti%:£.?Z>X 

(5) SfffSS (x) £<D (x) -S (x) Bt#^a<DfJ^WA (x) *B 
(x) mod 4) (x) ©ftS^tltfflV^Xf^&ttSit^Mt 

* m&m 9 * > - * v ^ =y mni&mi3&. 
[i#H2] 

taSBCs, t, f, g) it, (o, l, o, i)T?&Sdi:&4$«£"**»2fc3g 

StrfBA (x) *B (x) ©»«iil!(2$:Si:UTf!e) ; fe©t'$.'J, iff 
IB (2) © (f , g) it (0, o) T?&S£fc&4#«£^S»#^9ffi*cDW* 

s; n ^ m»«a*«6o 

[0 0 0 1 ] 
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[0 0 0 2] 

3„ I C*- Ke#tt«fflt&KpoTfebi*, I C#- KJB©y -^9>f #fc^b 

>f S*i 5 3*7 > K&gfeU Rcfto If- * <D<EjBHSe© 

«F5JK — ric#-Kj &£ffc&5 0 
[0 0 0 3] 

ICij-K0«, HUC^-Ti^lC, K101<Z>±tC I CA- Kfflf 

:/102<fe#*L HtCaK'T.fc^tC, -flSIC I C#- Ri, I SO 7 

8 i 6<DMmzfe&bftr=.&wizmifem!±ffi?-vcc > ^>f^gnd, u-t^ 
t, u-^f-9>f *frt>nm<D&iifc*>v -#^>f # £0)?-*<z>mm zn? (w.r 

ankl and Effing : SMARTCARD HANDBOOK, John Wiley & Sons, 1997, pp.41 

mm). 

[0 0 0 4] 

«^1**>S. *<B«/£l±, EI2fC^-r«J:e)lC, r^&Jl^BCC PU)201, fH'H 
^S204, Affi^J (I/O) >K-H207, =2 • ^ □ -fey -9-202^ (3 • :/n 

■fey9-t±*v^^=fc&s) o cpu2oni, &mm» j s>#ffim.w.&z&ff j !>mw. 

&^-fotf>-fc#<&S 0 -r-# A*203te, #ifi&iit§;UT'^5c 
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[0 0 0 5] 

fH'^^tt204li. ROM (Read Only Memory) ^RAM (Random Access Memory) 
, E E P R OM (Electrical Erasable Programmable Read Only Memory) & £:*7^ 

z>£.mm<D@kffitfrpmznz>r=.&>, ramc^h ^#£*i&<&s 0 eep 

ROM li, Wf 3 tlT *> -t © F*I^ S ^t^SS^^'JT? 

[0 0 0 6] 

3©3SJt*lt6(D#jfiBtt, John Wiley & sons*± W.Rankl & W. Effing^ TSmart 
Card Handbookj ©8.5.1.1 Passive protective mechanisms (263 << — i?) }C 3<Z) 

[0 0 0 7] 

I C#- KM^'^?:MLt^-5CMO S ft, ffl;frfKflR# 1 S> 0 VMi 
M<Dt=.isb, A7<Di&& l 0&5v^±0;fr£> l tc^foSh, *£fc««£#8lg*i 
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[0 0 0 8] 

^ibt^5f-^lCfe#bt, «MJ£#301^302tf)J:e>{Cj|&6,, 3 
V) ^otemZ. A* * 203 £ » £ - # ^ tMMIP£tt201 TMI LTV\5f - •£ 

[0 0 0 9] 

n • -^n-fe^ -9-202 CPU£M#BC, Mill 512hfy h^^MW^^TC) 

[0 0 10] 

[0011]' 
[0 0 12] 
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mamm&iz* ica- ^^v^x<Dmnm^mM^> mod N£fei£^>rf* vm 

JCJ:SSI»*I^SABR*(-l) mod NICEST, 3fc»B* fctt«^RA&, ^(D^E^ 
i7XN$:MV\t, tN + B*(-l)"g, sN + A*(-l)"f (s, t, f, gitmm. U 

[0013] 
[0014] 

tB^V^-JCf^^StlSlS-fe^rnU-r'^© I C#- KT'te, R S ABt#^\ # 
> 3knn&mm*B mod IHf\ ##5£<8^l!^H&iSU¥A(X)*B(X) mod e&(X)(B*£Ji 

[0 0 15] 

[0 0 16] 

JMfclftfCte, £&£!r&&3£A*B mod NCDffU MfcB2fctfttllHKA<BPl 
-etl^tltN + B*(-l)"g, sN + A»(-l)'f (s, t, f, g&4>&< 1 
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S = (sN + A*(-l)"f)*(tN + B*(-l)"g) mod N 
[0 0 17] 

[0 0 18] 

RS ABf-^TMVN^n^^^^lI^imy'x mod mzM 6 TM e> *lS*»JW 

jft«ias:±aB©fig«iA, -r**)^, ^»*d^«taiA*B mod N©ttw$:^e)i^, 

ffe8KB i &^Sm«A©M#S:, **l-entN + B*(-l)*g, sN + A*(-l)"f (s, t, 
S = (sN + A*(-l)"f)*(tN + B*(-l)*g) mod N 

[0 0 19] 

*i£»£»fcftSP&S£f£^3^ i:#ffiJilcfc5. s, t, f, g&^Pfr 
» & J&& b T & £: s £ © &&ft#t3g & fi 1 e» ii , v > # A fclgtfg & 

ft Heroic*;*;, a6^a>4t»t±m«"t*fe«), s ^KiSfrmii^-efe 

[0 0 2 0] 

[0 0 2 1 ] 
[^©Hi^Jffi] 
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^, mvi&mm^zmizziz. rs Am^izrD^xit. m^mm m^mwsx 

Fgj (^SHiitR) A.J.Menezes, P.C. van Oorschot, S. A.Vanstone^ Ha 
ndbook of Applied Cryptography, (CRC-Press) & £ izf? h < SB^£ tlT V\<5 

) mWHTJl^V XAilffi FW#3li&APll (J/a^'J^-7x77-^l) 
[0 0 2 2] 

mmm*mm-tz>\z%±Lib, n^t:^^mi^m^m^mmbxi5< 0 -mz& 

<t^ozt ($mmm^±m zMWtizLxm^timi&zftx^z. tmmm 
&&ft&w^m&v>ttmwft*><D£Lx. mmm#M£. m±o)mmMmmm^ 

^mizmmLxfflmLx^&&<DtfmR&mm j %x&2> 0 

[0 0 2 3] 

mmzRs Am-%zwiw~?2>* rs ABf#T*&, ±£&mm. mz-ixsiz^v 

WZ-DOmWiV, q©^ N = pq £. NhSVMCiJiftifc e (IC#-RT*te, 3^ 
y = L"e mod N 

Z-Oim^J: R fc^tflfco A xe mod (p-1) (q-1) = 1£&£|K#J^ x 

*m^x . 

y"x mod N 

ztm^-z>a rrr% (p-D(q-i)tt, lUDX^^-Mm&M* (n)t*&£„ rtitt 
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y" ((p-D (q-D) mod N = 1 

^ysc-fe, -#t% xe = i + k( P -i)(q-i) wtmm) £.m<z£tfx*g&<z> 

y*x mod N = L* (xe) mod N 

= L" (l+k(p-l)(q-l)) mod N 
= L*L* (k(p-l) (q-1)) mod N 
= L 

■tfmV\L-D 0 foT, y*x mod N&ftHt-£ Z £ T% ##t>±Ati, i£ff#B<£>5p 
[0 0 2 4] 

£f\ r^w ^3>-^x^>;£^icj:£ifif7;i/:Ji;xA{c^TEi4 

x mod N<DftH£. SSg^ x©tTyhS:2tfy h#tC|S^U> _L&;fr "b^AyT^ 
^tltf, 00, 01, 10, lltf>^-f ;ft,T*&£*MCfE;DT, y[o] = 1, y[l] = y 
, y[2] = y"2 mod N, y[3] = y"3 mod N £*fj££i±, m&mntfnZft ? Z. 

[0 0 2 5] 

£?\ tfy h-r--y;i/y[0] = 1, y[l] = y, y [2] = y"2 mod N, ' y [3] = y" 
3 mod UZmM-tZ (Xry^AOl) „ m^TDJfflit (X5^y -7402) fcfi^, 0k 

1 0 £BH$f 2 0 0 1 -3 
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LTV>*W*,. jMUTt, »7UTV^tt*Wi, 4^©im 0^^404) £ 

mzfit>thZ>m£fkmimzjS^Tit. ZkftftV&mm (X^y405, 406, 407 
, 408) tffilDft. •Zn j en<D0kftfcftj&LZ, X 7^^409, 410, 411, 412© 

[0 0 2 6] 

it 



&5tU±tf£c 3Z1T% 219li^5iiS:^T* 110110117? & Z> . 3*1 £ £ IC, 2 If 
y HB©77V 5/ a >-^i-T >^^T'ftWr^o 11011011£2tfy h^n y 
#m-rZ>£. 11 01 10 ll-e&£„ S = 1 (Wfflfc) &??&V\ ZL*l£N£i£i: u 
T4^-T^ 0 £7ffc> IS: 4^ U T=felT'S> -5 . #ClCfgMStf>$fcgRtf) tf >y h y * & 
S5tf. 3*U*, llTffeS^P), y[3] = y"3 mod N£fH£T, S = y"3 mod 

So #ac, St>*;i/-^L, iix&N&jSi: bT4^f-5i:, y A i2 mod N£:&£ 0 

17?&S^e>, y[l] = y £fH£T, S = y"13 mod N£ft£ 0 #t>*;i/-:/U rti 
£N£&£ LT4m-tZ>£. S = y"52 mod N£&£ 0 *B«fflS®lfv h^fl»;i'® 
5tHI^>3#B©tf >y h?U v V &tfctt£. ZtllZ. 10T?feS^e>, y[2] = y"2 
mod N 5:f S = y"54 mod Nfcfc*. Stf^-y^U 3;ft,£N LT4 

3fe"t*i:, S = y"216 mod N£:&£„ f8»fflJ©fc?v h^D-y ^©M^e>4f B© 
tf y V"fU V V %mti£. itltt, 11T?*S*^, y[l] = y"3 mod N &f 
, S = y"219 mod N£&£ 0 £*1#:&#>S& , T?&S. 
[0 0 2 7] 

•#>f > K#:£^£ov>TB5 &Mv>T.&i!l!*<&. 3 y*x mod J^ftlt 

SBR©x<Z)S^:©«I ! a#te«:2lf y htt5. £1*, ^->Oby[2] = y*2 mod N, 
y[3] = y*3 mod N^Jg^S (^■f-y^'501) . 1 fCfcJSB-ffc U 



S = y"219 mod N 



1 1 
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^502) , JB«xCD*fe<3!)hr y b T*&£ £ ? ^ £¥'J5£ L (X^^^503) . if^T 
(*5^v:/504) . *g«x© 1 fc? y (*r-y:/505) > m*UT»«!^'*l 

5tL (X^>y^508) , gtfEttlfctttitf, ^f^^a (^.^^^503) KM£ 
tf, I©iltlixCDft|fe* , e^i^ill7ttV\5CD'Tf, :/503tf)^f4niYes 

^m^tm (^^»y^510, 511) &H*?U S^ft^l^I "75.03 

) JC M a 

[0 0 2 8] 

^tit;. mmmr*nmzmMLx&< a mult 

S = y"2226 mod N 

S:tt#-r'SJC*fe»;, -r-^;i/y[2] = y'2 mod N, y[3] = y"3 mod NfcfflS-t 
S. r©|^> y[0], y[l]WHT*fe§ 0 2226&, 2ji^T*, 100010110010 
<£fc#T?£S. z.frZ±&£VWt/u~Z\ 2tf v hau&_tftac*# oTv^ii^te 
, ^tifc-Stil^&U Otfj^-O^fc^W:, 2^BBfj^ai3S&fT3&'2> fc^sOs-r- 
O^U, 100010110010 = 10 0 0 10 11 0 0 10 £ V^#ft?fC*f£S-f £ J: O IZM 
m?Z> a $£oT, S=lfc*JJ»fl;Ufclfe, *r, lOJC^t* SMS, -T&fc^ SCD 
2iIMI5:^ot, SlCy[2] r©££> S = y [2] = y*2 mod N£ 

•t5„ OlCM/^bfcMI, f **3^2^JKj^?SII|[S:fT*io , r, S = y"4 mod 

N£=j#5,, m<0lZttfc'tZ>f&M. S = y"8 mod N&>tj&V\ #clC lOfCMfS^S 
^Sfc?? S = ((y"8 mod N)"4 mod N * y"2 mod N) mod N = y"34 mod N 
iK<fli3«,' lHCfcfjSUfc, S = ((y"34 mod N)"4 * y"3 mod N) mod N 

= y*139 mod NSrUfft-S. £<b&Ci^< 2^><D0K.MJ&LTmM&fc&&4fte^ 
, S = (y"139 mod N)*4 mod N = y*556 mod Nil L, *|fe©10tC*flSf S^SS = 

((y*556 mod N )*4 mod N * y" 2 mod N) mod N = y"2226 mod NICfcoT, 

1 2 ftJ$E4# 2001-306603 2, 
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[0 0 2 9] 

>=r^u&i:tt, si&^irsu* ab mod mmmzmn-r^^r^^, 

U ©IK^SWC "Modular Multiplication Without Trial Division" , Math 
ematics of Computation 44, 170, pp. 519-521(1985)) {CfEig£ 4XT V\£„ 
[0 0 3 0] 

^>=f* USs<0*Ktt, 5&^T©=I>trrL-^ JC«V%T, mod 2"n<D}HH« 
, ±ffifcfv h fcfcmfSdfclCj: »; §i|JgT*£ S i: ^ ? 3 £ £f'JMir5 Z. £ \Z%>%> 
„ 1"&:b*>, AB mod N<Z)ftJ|£2<Z>^££&£t-3M3?f;:B£#l*.£3£SC, 
©#R#&S. RS AlM-eW:, Nte, ^i^IMtSS^^tltS'J, 
tfcoTtt*© 2 WC3R-£&S. fit, M, WZmftimtlsttfeJ: 

AB + MN = WR 

&#;L£c lit'. A, B©lfy hfittn-efcStiffli: U R = -CD 

r"(-d mod u£.&mx*&& 0 mt. re^icm^*??^*©-??, R«fcy/jM*v^£© 

ffij^fctlSo Wli, ABR"(-1) mod NT'fe £ £ £ ABR" (-1) mod N+ 

[0 0 3 1 ]. 

rcDi^fC, ^E>rf* D&fCfc^T&, ABR*(-1) mod NCD^itlfWf 

01, ^9>f-?-<>y- > K^#^T-ttgl5tf)501-£S!ff 2*l£^-:/;i/#J?£ 
JMtCfcV^T, ftl-^tl^^-^l/CDlBS:, y[0] = R mod N, y [1] = y*R mod 
N, y[2] = y"2*R mod N, y [3] = y"3*R mod NfcS£&;*.T*G.3i-S. S(D%}M 
M%R mod Nt-rs. %c3fcmk£ffc%LZ<DmZ. % ©-fitOR^tC^: o T V^ 

SfcAb, ABR'(-l) mod NMST'te, &1*Rte©£tf35£.£ £ &C&£ 0 Z.<D?- 
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, ^^-Tt-V yif.-yj-y K^M^fe, ^if* U hTf^frU § 

tfelC, R*(-l) mod Nte-tSifctCfcy, #ft6ff&#SifctfT?§5. 
[0 0 3 2] 

^TffimcmWLTlS< a t-A-7n-j?tIlt ^#^«©^^^(CJ:oT 
tt, N5^SI<Z)ffitC***"eNS:5[§3SC"tS^i:JCJ:oTA*B mod N^r^dbS £ V^ e> 

*>©Tf&*. o*y, rt-A-7n-j A*B#NjgU:tcfcS£ 

V^j£flsjCflB&e>*:^. ro^tt, A*B©lfy h*#/J\SV^£tt:i-- K*fc 
[0 0 3 3] 

fc^^tc, ^zf* uasrew:, &n (*f») &c&ttsi!b&£ftjf-f s £ y =&> ssr 

= 2"n (nliA, B©fcfvh«) £ tFlld*3IV^ CI £ fC^B 

AB + MN = WR 

[Ciot, A*B*R"(-1) mod N©ff» £±fE^/g3r@5£tf)M = -A*B*N" (-1) mod R 
& #«>.&i8f£ Mi, 0Jt^J:R*p(D^HlC-o#^E^^ o itl&*«) 

A*B*R"(-1) mod tiWrnfe-? &fr£.^o t. ^ 3 T*tt&VA 0 (JEStT, 

A, B#8E£ffiNT?<B|SI&T?&*lH:, A < N < RfroB < N < RT'&£, M 
< R-e& £<Z)T*, 

W = (AB + MN) /R < (NR + RN)/R = 2N 
-d*»J, y =&/Jn£V^, NJ: y*£VM»TtBtt#&5. 
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mmi tit. N^-ni§i<iWjsts. 

[0 0 3 4] 

y A 2 = x*3 + ax + b 

y"2 + cy = x"3 + ax + b 3U£> 

y"2 + xy = x"3 + ax + b 

[0 0 3 5] 

p Sr«gil-rS«E«ai<Of!fj^ait Zp Zpit^t LTJ±, {0, 1, 

2, p-1} Kl— St-TS.. ZpJC&tt£fn(+), 

A (+) B = (A+B) mod p 

A (*) B = (A*B) mod p 

J#oTVn£ 0 iti&jRttfcvn^ GF(p)h#< 0 ift#ftfc||C*&»fc;&l8#©0!l 

■e&s, j^t, asLtffc^isy, (+)irM^<D + tm^. (*) ^> jt^oa* . 

[0 0 3 6] 

#ClC, GF(p)©7cS:#atCfir-o#^ f(X) £#;t, "5, GF( P )(C 

^*ftfcV^<B&GF(pHcSSfl[I'r.&z:fclCJ:oT, affUV^&fll/S'rSifctf-e 
§5. dtlfc, GF(p)©^K&f$»Jfc:fc#i:v0 0 GF(p)0>WI8&ft»i4;*#<D7C 
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[0 0 3 7] 

mmmfem m^mx rttm&xrii mmmjg. p. 125 ^ma) icj;n^ gf 

(P*n)&, GF(p)&m<D&mm>fotf-D < ZMGFip) [X] £GF(p) [X] (Dn&mm^ 

^:f(x)cD^^#:cD^s-rT i r;i/{cgi-t^>0j^GF(p) [x]/(f a))£mmv&& 

0 Z<D$S. f(X)(±g56^T'^^fenii, M£ LTtelBj ^ot, jg?U 

« £ -T -5 r £ T* G F ( P * n ) (D m& & V 4 9 U n y \* =l - # ± iZ m m -f & 3 £ tfi T* # 
[0 0 3 8] 

i c#- \*<D±T*m&-t&&&te. mzmmF(p)(pitmm)(Dm^£^-(i-v 

#GF(2*n)<J!>|B-£tfmMT?&S. GF(p"n) £, p©^^ $ & V>f ^nn>tfn-^ 
[0 0 3 9] 

P9ffii»_L©-o<Z>j^, P, <*&&&£&* rtOzlj^&fiSiiCiW&Bf^ (P=Qtf)££ 

tt&Mi & § f < ) , z. <d m&tfn ztn rc mm £ &t> s j&r & x w tc 53 l t 

«Rffi«8±©j^Pfcx|||tcHLT^3&ttiBtcfeSj^S:P<03S»7ni: 
VH\ -PT'^-Tc ^Hffi«l±©-^P$:k^[lx.^ : bCD$:, kP, -P&kfiiDA.fetj 
£>£-kPi:#v\T, P©*#^— f&fcv^. £*i P, Qtf>M^tf>;£3l5S; 
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GF(q))£#< r ntf&2> 0 G(E/GF(q))<Dm^timizmmx^ mmm*\ 

[0 0 4 0] 

#RfflJ»-h©/aP=(xl f yl), Q=(x2, y2)<B?HP+Q©MR&(x3, y3)£-r& 

tfltt, ##M(non-singular)T^S : fo©i:i-^ 0 
[0 0 4 1] 

««#2, 3T&V^li? : . 
y"2 = x"3 + ax + b 

x3 = h"2 - xl - x2 
y3 = h(xl - x3) - yl 

Ht, hit. 

h = (y2 - yl)/(x2 - xl) if P*Q, (3xl"2 + a)/(2yl) if P = Q 

[0 0 4 2] 
««#2©»<£ : 

y"2 + xy = x"3 + ax + b 

x3 = h"2 + h + xl + x2 + a 
y3 = h(xl + x3) + x3 + yl 

h = (yl + y2)/(xl + x2) if P*Q, xl + (yl/xl) if P = Q 
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T 



[0 0 4 3] 



[0 0 4 4] 

gfchCBff-jSfcuod pT?^fTLfctt*ltffc*>fcV* 0 O £ U , MiH h = (y2 - 
yl)/(x2 - xl)ii, h = (y2 - yl)*{(x2 - xl)"(-l) mod p} mod ptMfflZn& 



[0 0 4 5] 
[0 0 4 6] 

mH®m±<DMmttwmmt>mmT*$>z>z£.zmmi>x^z> a nmmmzmmv 

[0 0 4 7] 

7f»;y i. ^m#b^«, je«e» x[bj z.nzmmmt. ut^i, 



x3 = (h*2 - xl - x2) mod p 



y3 = (h(xl - x3) - yl) mod p 



Y[B] = x[B]P 



1 8 
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CI = rP 



C2 = M + rY [B] 



Z. 5£f§#B JSte, CI, C2£^WJfc>J, ©^COMItx [B] £Jg VMT, 



[0 0 4 8] 

£#){C, ^-^^>bP0f-^^5. ^^SHjfcSIJMCfc^Ttt, mod n 
T*tf>0iH, li, 2m, 3^iC*f^LT, 0 ■ (&IS3gj&) , P, 2P, 3P?:Mtt 

§U^y^80i) o ^ £ 111^^31 £ tell r<Z)-^-:/;w;J:«[ir»£#l;i£ 
ifrgtt&<, &£>fr£#)M;ftLT £< r h#T*££ 0 #ac ft JIM ©^©i!*^ 

mik-tZ (X-rv7802) . #ac,£S© 2fg£ff3f£L (*^*y:/803) koft 

©fcfy h CD-fit' (2¥yh?£.) tC«fcoT^#^HSLT ( X -r y :/804, 805, 80 
6, 807), rtie>ic^^-^^p[o], P[l], P[2], P [3] Sana.* {7.7"*J-f 
808, 809, 810, 811). Zl <Z>#t3g &k(Z) If y h * * HffiVt Z> Z. t. IZ J: »J 

tj^fc^S, ^^-f-r-f > K^^td-TSd fcfcg^Tf&S. ^fci? 

tMP^-rs^, RSAtcisttS^SIflJjfctStl*, «RffiiW±(Z)JlI*S?Ri(Ctt, 

Zn, G(E/GF(q))^V^^f^»*©±^fT*3tlS^RI^i:#^.<5ii:^ , ^^'S. 
[0 0 4 9] 



C2 - x [B] CI = M 
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[0 0 5 0] 

mm<Dmmmi&mMT*&2>. *mmw&. ^gfkffl&mmy** mod N^rf-f s> 

fllSfCfc^T, A*B*R"(-1) mod Ni:V^e) ^^J^M^* ,^ ffiV^ P>tl-g> 0 ^iC«E^^ 
[0 0 5 1] 

2:1 s , X-ry^90UCT, S = R mod Ntb, ££fC % xtf) If y h :/ U V >7 £># 
#&»*.Sfc«>®#tf:/* jSrOiCMftU &#^*55£ffi.0>gE»v [0] = Oilt 

5^y:/902) £<Z>BI, ®S©7r^ S/a >-^x>f >*&a»c#g&;*-y ;i/ 
7=--^;K903)y[0] [0] = R mod N, y [1] [0] = yR mod N, y [2] [0] = y"2R mod 
N, y[3] [0] = y"3R mod Nfcfl&tC, ^ V =l v XN(C £ W ^>K^- (904) y[ 
0] [1] = N - (R mod N), y [1] [1] = N - (yR mod N) , y [2] [1] = N - (y*2R m 
od N), y [3] [1] = N - (y"3R mod N)£=&m:t-f£o ^->OWi*iS, R AM± 
K&&-fZ> 0 Z.<DT-7Mtf&<D%k. 4kftftm#km (*^y^905) {CT, -fl» 

o^T©^y h zrn v ? (Dmrnxmr Lx^^tevtut, x^v:7906ic3i#suRv 

[j] S»4t5 (^«r-y^906) 0 o^feiiiT-feSo mz. S = S"2* 

R"(-l) mod N&2@Hff"fS (X J ry*79Vr) „ ft*U©^a , ri±, S = R mod NIC 
Mtt£*lTV^tf)T% mPJ^^^CD^tt, S = (R mod N)"2*R"(-1) m 

od N = R mod *J> ^.^^^907(D^a^^«, R mod N£ & £ £ £ iZ^M~T 

mz, &&&&&& (* 7^:7908, 909, 910, 911) JCfcV^T, *g»x 
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<D 2 ¥y h -fa v V £fc^, Z.(D¥v hzfUy 9 (®t£T*te r x tf y h ^ n >y 
V J £:Stig$*lTVN£) 2Ji$CT% 00-e&3;fr01T*&3a\ 10T*&Sft\ 11 
T*&£;fr{CJ&DT, ^41^11, X-ry^912, 913, 914, 915(Cii#, mWffl 
^W^ffOo ^©m^0J^^T^i, v[j] 0T$>S*\ IT&StWC/SC 

r, m^2>T-znimtfm&z>o mm*. x<d¥v b7uy?mov&n\*. m 

Stt, S = S*y[2] [0] *R" (-1) mod N = S*(y"2R mod N) mod Nfcfflft- v [j 
]. = KDtLgl*. fiL&T-7)Vfr<b. y[2] [1] Sr&yffiUT, S = S*y[2] [1] *R" (- 
1) mod N = S*(N - (y"2R mod N))*R"(-1) mod N&ft3M"<5 (^7^^914) „ 
^.^^^912, 913, 915©*MtC;j3^ , t ; fc, H&fcv [j] ©^JCffi CT^-Ste 

&^x.&„ ^iMahfc&ai x5^y :/92hct, xvyzz^ytv* 

>hU ^^^y905©^SIfCM^o 3H4^H£MI (*5^y^905) tCT, flifcx 
£>t^y N:7ny *&£TfS*»;hoT^«5*-£K:W:, v :/916©fll3S(Cjtfr 
. ^-ry ^9167? It, 'E^^'J^ (R mod N###o T^S) CD^-^&itS 
©'MtcM-rfe^fC, R*(-l) mod N&mi*<5*U!S:f?3. T = N - S£ff|f 

U i*l£RAM&CB< (*7=-y^917) „ 3~T% S£mRAM±-eH&3& 

>y^918) ICT, ft|fe<Z>vC!)«#l-e&*Ui, T£ffi;frb (^^^^919) , v = 0T* 

( t N - B ) " 2 mod N = B"2 mod N ( t ftffiR) Tf&S 3 £ B£ £ ^ 
T&£= z.<D£5iz#imirz>z. tiC iot, t - A - 7 O - fflffiaA'**©*)© 
£t«fcSfc<DtCfc$fc«>, ICfy^lim ^St$fl9^£»ILTI*I 
mtim&ft-5Z.£tfmmiZ%i&. ^tlte, 3fcS*ifl&$il8:A*B mod Ntf)A£sN+A*(-l 
)"f, B&tN+B*(-l)"g(s , t , f , gl««)lC«£&*.fc££lC, #&C(s, t, f 
, e) = {(0, 0, 0, 0), (0, 1, 0, 1)} £ Lfe&VXD—DV&Z ( {} ft 

[0 0 5 2] 

0, 1, .... m-l(mlitf >y h^U y Z (DM) *0 £~f lfctfi^*, SIDIC 

^^.Mc&ji-f «i:v^#j5i;fc&$. eiioic, ifts^t. sfcif^^y yio 
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OltCT, S = RmodN£U $ £ fC, x© feTy h :/n y 2 ©#-^&»;*.S 

•7)lfcf&*fto (^T-y ^1002) 3 ©BR, Ifffl7fOa>-fx^>j5l 
SlC&KfctfU i/±JV^--fjV(l003)y [0] [0] = R mod N, y[l] [0] = yR mod N 
, y[2] [0] = y*2R mod N, y [3] [0] = y*3R mod N©fffilC, ^^a^^NtCfeW" 
•2>^te5 : --> r ;Kl004) y[0] [1] = N - (R mod N), y[l] [1] = N - (yR mod N) 
, y[2] [1] = N - (y"2R mod N), y [3] [1] = N - (y"3R mod N) £ fcjgjfc*- £ „ 
-r-yOWiiiS, RAM±{C#^-r-5c 3©^-^;i/#^©#, ^1005JC 
£#gL«v 5 „ £©&,«», 0*fcfcl:n?&S. ^C^ff^^l C*^ 

*0 £fl^£ 0 ?£(C, S = S'2*R"(-1) mod N£2|nf|&fT "T £ (X^y:/1007) . 
*^0©M^-e«, S = R mod NJC*JJB-fbS*lTV^©T», 3©^0J^?I»T*tt 
, S = (R mod N)"2*R"(-1) mod N = R mod N£&*J, y ^l^KD^W^^t. 

, R mod N£:&&r fclC&K"*-*. (*5^y:/1008, 1009, 

ioio, ion) tc^VNT, tlffcx© 2\L*)\zfu v * &m&. Z.(D\±v h-fuy V 

^;ft*^y ^1012, 1013, 1014, 1015lC3i#, ^»»5fciR!r&fT5. fHHM 

o iifl x©lf v h?n y #m0T*&ft&, Mfti*. S = S*y[2] [0]-«R"(-l) mo 
d N = S*(y"2R mod N) mod N&ftJTr * v = l©fc£tt, Bi1£ J r-'7Wby 
[2] [1] fc^UffiLT, S = S*y[2] [1] *R" (-1) mod N = S*(N - (y"2R mod N))*R" 
(-1) mod N$:ft^:-rS (Xf'y :/1014) 0 *^>y:/1012, 1013, 1015©#L3lfC 

X^y 71021JCT, U ;* > h U * r-y :/1006©*MlCMS. 

*##HStf&Ji (X^y^l006) ICT, *g«x©lf y h^"n»y ^S^T«*»t>o 
*7^y :/1016©#l3llCiitf„ X5^y ?"1016T*te, ^>=r*uj£ 
a£ (R mod N*»ot^S) ©^-# $T3i^©filCM-tfe^{C, R*(-l) mod N 
£fH-f £M3g£?f 3. #CtC, T = N - SfcftHU ZLfrfcRAMtCtf < (*<5=-y 
^1017) 0 rrf, S£T{£R AM_hT?Sfc*&tttCBB«3*U RAM±t*lSf 
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%>z. mzt^^cDn-tz. $kft&mti!M (*t^^ioi8) izx. m&<Dv(Dm&i 

71020) 0 i©ffi3llC«fcoTiELV^^ttJ*atlSr iltt, ( tN-B)*2mod 
N = B"2 mod N (t ttSBK) ■pftSitfrfeifemS. Z<D & $ KiUM? & 

3*Ui, ^»J^M^tA*B mod NCOA, B£_tfEtf> J: ? (CS^glx. £ £ tC, 
#&C(s, t, f, g) = {(0, 0, 0, 0), (0, 1, 0, 1)} h hfr%(D<D—D 

[0 0 5 3] 
[0 0 5 4] 

JfXf>y ^HOKCT, S = 1£U ££&C, x©tf*; h^nyir0#f ift^. 
5fei*0*^>^j$:Oi:W[:l, &##iBfil5£M©gBRv[0] = 0£-f3 o #uc 

2t* ^r^-r isBy-^^^yjj^mmm&T-J'M^F&Zft^ (*^y 71102 

1103) y[0] [0] = 1, y[l] [0] = y mod N, y[2] [0] = y"2 mod N, y [3] [0] = y 
"3 mod N<Z)fte(C, ^^9XNtCfctf3R3E^-:/;i/(1104) y[0] [1] = N - 1, 
y[l] [1] = N - (y mod N), y[2] [1] = N - (y*2 mod N), y[3] [1] = N - (y"3 
mod N)$:t,MSt-S„ r-^HJM, R AM±&C#£-T £„ Z.V'r-T'Mt 

&<d®.. atftftm&m 71105) izx. tmxwm&txmzftt-fr (± 
m&feTLx^tzvftaz. *^y7iio6K£»sL»v[j] s„ r<z>SLfm 

, 0*feiilt*$)S o #ac, S = S"2 mod N&2|Himf"*<5 (*t- y 71107) „ &IC 
, ^{^Hfc^M (*7^y 71108, 1109, 1110, 1111) .tCfeV\T, *B»x©2K" 
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V 



Ig£*lTV^) 2ii|5[-e, OOTIDS fr01T*&££\ 107?&SA\ llT*&£fr 

(c/^dt> -en-?*i, ^-r- x y^ni2, 1113, 1114, msicji*, mw-ffl&& 

S*y[2] [0] mod N = S*(y"2 mod N) mod N£ftJ§C-f S v [j] = KOfc^li, M 
^;i/^e>, y[2] [1] SrflSiyffiLT, S = S*y[2] [1] mod N = S*(N - (y"2 m 
od N)) mod NSrfMSEi-S (^^^^"1114) „ ^^^^1112, 1113, 1115tf>#L3 

leaser*), ra«»cv[j] (Dmzj&vxmn'zmit^iiz. mum^m. : km^r=. 

^^^yii20{cx, #»*>*&>f>*y*>hu *Tv7no5(D#imizm 

fcoT^SSB^lCW:, 7.TV7lUG<D®M\zm%S 0 7.TV7llWV\t, T = N - 
S&3f£U ^*l£RAM{C©< 0 SfcTl±RAM±T?M'&*tettK:BBfll 

, S^m^Jl-^ (^^^^1119) . 3<Z>&«lC£oTlEbV^#ffi;d£*l£3h 
tt, ( tN - B )*2 mod N = B"2 mod N ( t ttfif») "C£> £ ^ il # & m 8» J^T*2& 

M&£%tfHC&££#), ICf>y^©ltt^, &«!$IW&«iMbTrt8M!l 
m*ft5 £fc#HjfttCfc*„ £*Ui, 3ft»»J^?aHEA*B mod N(Z)A, B&±fS<7)J; 

■5tcSSfil^.fei:§Jc, #(c(s, t, f, g) = {(o, o, o, o), (o, l, o 

[0 0 5 5] 
[0 0 5 6] 

(1) S X = A*B mod N&!tltSXf7^ 

(2) (1) 0f^ti'J(:S 2 = {sN +. A*(-l)"f } * {tN + B *(-!)" g} 
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mod N (s, t, f, g&4>fc< 1 oliO -e&V^|fcT*& U> f, g 

1*0x1*1) ztm-tzxrv?. 

(3) _tia (i) £ (2) ©v^;ftfr£^i:»^3x^y^\ 

(4) _lsb (i) (2) o) zm&mvmL, mmz±m en sraiiRufci: 
gtt-eoniMgaiSj&ffi^u ±sh (2) sai^LfetsjcttSgO^toyKiN 

(5) S^N-Sgfc, Rgp #«LSI©i!l^*A * B mod N 0) ft##SJH L T 
[0 0 5 7] 

±m<Dmmw (@9, si o&tmi i©3&6i£«) tc#3^-u±, vultum 
fc, -tga^Jfeflfeii, s, t, f, g&-jfi»;icL^3E'fbs*rv^vA3S«, <k«j 

[0 0 5 8] 

*-f^^y^i20iicT, s = ltu ^^(c, x©try h^n v *<0##&8t;it 

> 4 o©SURii[k] (k=0, 1, 2, 3)&MSt--2> . Z.CD$im$. 0 

< w[k] < MAX&?Hfci-SE»-e, MAXtt, ;* *E U ^ U * CD±% $^<Z)0j^J(C «fc 

e> (^.^^^1203) ^©ik, ii^^TT 1 ^ s/a >-f-a:>r >*aatc^5?3fe^ 

U S^^-;i/T'-^(1204)y[0] [0] = 1, y[l] [0] = y mod N, y[2] [0] = y"2 mo 
d N, y[3] [0] = y"3 mod N£>tifi&C, ; E*;a9^NtCfeW*iR<E-r'-^ , ;i/(1205) y 
[0] [1] = N - 1, y[l] [1] = N - (y mod N), y [2] [1] = N - (y"2 mod N), y 
[3] [1] = N - (y"3 mod N) £ ^MlT £ 0 ^-:/;W*iIS> RAM±lC#fif5 
o Z<D"r-7)lftf&<D%i. 3kftfrm.Mm (X^y^"1206) ICT, Jg»x*«*tfei[ 

y h:7n»y*©ffiSi#»7LTV^tt*Wi\ ^12Q7C£#SLBtv [j] 
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Z.(D%LWl%> Ot.tc.ltlT* 2b & 0 #C(C, S = S"2 nod N%2ia||fT'r« (X^ 
y^l208) o #ClC, :/1209, 1210, 1211, 1212) JCfcV^T 

#\ ll"e*)5^tC/SCT, -etl^tU ^t-^^1213, 1214, 1215, 1216lCit^ 

5tknffl&&&&47$. mmM&&#"eiz* v[j] ot?&s*\ iT*&s*ncfS 

3®Stt, S = S*y[2] [0] mod N = S*(y"2 mod N) mod N^ff-J^Stf, v [ j] =1 
(DUglZ. y[2] [1] &$»J|fibt, S = S*y[2] [1] mod N = S 

*(N - (y"2 mod N)) mod N&ff-3M*& (^f=-y^l215) . ^^^^1213, 1214, 
1216(Z)ra^CfeV^T=fe;, Rf^JCv [j] ©-fiiJCJS DtifSf £^*.£ 0 f^fT^M 

aS:»^.fclfe, x-ry :/l22ncT, *-?>^&^>^'J^>hU x-^^^1206 
©flLSK^S. *##fl£*&JI (X5^y:/1206) (CT, flRxCDlfy hzfn*j9i: 
^T»*j»fcoTV^S»-&JCtt, ^1217<Z>*&3SlC3itJo ^"T-y ^12171? tt 

, T = N - SfclfJIU rtl£RAM&CS< 0 iitf, S^Tte R AMtM*§S 

y^l218) tCT, Sffe©v©4t#l-e&*Ui, T&m^Jb (X^y:7l219) , v = 0 

tlSdfctt, ( tN - B )"2 mod N = B"2 mod N (t T'feSXi:^^! 

[0 0 5 9] 
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[0 0 6 0] 

m 1 3 *mfcWlW'tZ> 0 *-f\ :/1301lCT, S = RmodNilU £ £ fC 

^-zTMtfo-kfio (^.^^^1302) „ 9--7JUt. If0r- -f VMfiyto] = R 

mod N, y[l] = yR mod N, y[2] = y"2R mod N, y [3] = y"3R mod NT^f&£ 

*u mwmn&Bizm^zixmT-^jiityfimv&z* T-^wtmn. ram 
_L&c#&-r£o i(Df-^Mfflt. (x^^^i303) {ct, m 

x(D±T(b\Zv h^a^^^^S^^TbTVN^^tlli, X?=-y ^1304{C*i<fr§L 
$fcv[j] £#g£1-£ 0 ZKaSLM, 0££&l-e&5 o S = S"2*R"(-1) mod N 

^mmfi-t Z> (*^y :/1305) „ *gJ©*raT?tt, S = R mod NfC*J«B-fb3 tlT 
V^tf)"??, ZKD^^J^^I^Tli, S = (R mod N)"2*R" (-1) mod N = R mod N£ 
*^y:7l305<Z>flt3Ij|gaiW:, R mod N£&£^ t.K.&M't&o #ClC, rtf)S 
S[0] = S, S [1] = N - S£ff|§:LRAM±tC;fe£ft1-£ (*T-y :/1306) 
c 8^T, 3M£#([£4M (*-ry^l307, 1308, 1309, 1310) {CfcVnT, *g»x 

j fc^JgsttT^s) 2ji^T% oo-e&£;fron?&£2>\ iot?&**\ in? 

-ttl-^tl, X^y ^912, 913, 914, 915lCji^, mMffl£ 

mnzfi^* §(kM.ffl&m&.'v\^ v[j] ot?&«6*\ n? 

= S[0]*y[0]*R"(-l) mod N = S*(y*2R mod N) mod N£r3f-£M* £ v[j] = 1© 
£ tt, S [0] ©fU3 *J ICS [1] U fB IT, S = S [1] *y [2] *R" (-1) mod N = (N 
- S)*(y*2R mod N)*R A (-1) mod N^tfU^S (*7^y ^1313) 0 XfVflSlU 
1312, lSMCD&SUCfcV^fc, PI«tCv [j] ©tflCjSUTail'S'lBSrSEA-S- ££C 
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^■l303©«tatC.MS. ^##H£#t.3l (*7^y ?1303) ICT, ftjRxCl^y S^n 
v * S::£TaB#»fcoTV^*<£lcW:, *-x-y :/1316©fll3lC3ftif. X^^^13 
16T*&, ^>zf^U^ (R mod N»ot^S) GD^- # £ jl^tf)^ {cM-t 
£#>&C, R"(-l) mod N$:m-r^ra$:^e)= #ClC, T = N - SfcffHU itlS: 
RAMiCft< (^T-y^l317) o ilt, SfcTttRAMJtT*M.fc5&«iCBI{fi3 
*l, RAM^T'Slgt'SZlfctt&^fcafc'rS. (X5^y:7l318) 
(CT, ft«©v(7>ffiAU-ea)*ltf, T£ffi;dL (X-^y^l319) , v = OTf&tltf, 
S£ffiij-T£ (^7^:71320) „ Z0mmK£^TiEL^mtfmjjZft2>Z£te 
, ( t N - B ) " 2 mod N = B"2 mod N (t J±fi») " "e&5 £ 6 

Srff^Clfc^K'jitC^*. r*Ui, ^3MfofciB2!tt*B mod N©A, B£_hfa© £ 3 
JCtt£#lxfc££(C, 4#JC(s, t, f, g) = {(0, 0, 0, 0), (1, 0, 1 

, o)} t Lt=.%(D(D-^T*3bz> a znz^>3*vm*m^t&^i33:^M-tz> 

[0 0 6 1 ] 

13O50&3liffii|n?, S = (N - S).*2*R"(-1) mod N(B «fc 3 iCjM&ff 3 £ i: tC J: »J 
[0 0 6 2] 

±sh ay mmm it v ^ r ti % > ^ % m^j^im ic # l t s *i & % © -c & 
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T 



( t N - B ) " 2 mod N = B" 2 mod N ( t tefiER) 
[0 0 6 3] 

liittGF(p)(p&*£&Hf&){C^T, ffRffiifelE: 



&#*-£ 0 SfctcM^J^tC, E±<Z),&P®*#^-^kP£ff|ft-£l§Ali, j&© 

HC^I & f t ffifi g & & & W ti it & <b & v ^ 3 h # *> 3 . 
[0 0 6 4] 

^CizE^fe £ ? JC, fl|Rffii»±<Z>j^P=(xl, yl), Q=(x2, y2) ©fnP+Q<Z>l£« 
&(x3, y3) P+Q=0-e^V\^^ 



h = (y2 - yl)*((x2 - xl)"(-l)) mod p if P=5fcQ, (3x1*2 + a)*((2yl)" (-1)) 
mod p if P = Q 

[0 0 6 5] 

h = (y2 - yl)*(x2 - xl)*(-l) mod p if P*Q, — (El) 

h = (3x1*2 + a)*(2yl)" (-1) mod p if P = Q (El)' 

h"2 mod p (E2) 

h*(xl - x3) mod p (E3) 

tte&o (El)0>flt3ffilCJ3V^/ A = y2 - yl, B = (x2 - xl)"(-l) mod p(*£ 



y"2 = x"3 + ax + b 



x3 = (h"2 - xl - x2) mod p 



y3 = (h*(xl - x3) - yl) mod p 
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T 



&x2 - xDfc-etl^tl, sN + A*(-l)"f, tN + B*(-l)*g (s, t, f, g&«$[ 

z> ( (ei) '(Dm^^mm . h&(E2)(Drac£^T?£pfc£^T2fii£*i, ^ 

[0 0 6 6] 

;&lK#Jfc*S3BWK:fcV*TSif$!Lfc<3D*C» ZZT'lt. 2>fgff|fCS = 2SHS = S+P[ 

j] mmmzm^xmrnzfto. b skews, *^>yy803 (2^tt 

HO > * 7^^809, 810, 811, 812 (ftJCZmHO ©MSK^IgBJ!©^^^ 
[0 0 6 7] 

T?©tf*tt, £T> i£p<Z>fcfcT?2g*rr*W*«fcv>. M l 5 l±GF(p)JiT?©«Rifin|* 
E: y"2 = x"3 + ax + btcJ3tfSj&P(x, y) ©2*»ft »JC#$8l$! fciiffl U £><Z)T' 
J^T, 2P = (x3, y3) 
[0 0 6 8] 

*-x-y yi40HC;k^T, Dl = (2*y)"(-l) mod p&ff»fS. #CfC ^r^^l 
402JC-T, D2 = (3*x"2 + a) mod p5:ftiSf 3„ itl&Dl, D2{C*fLT, 
;i/Dl[0] = Dl, D2[0] = D2, Dl [1] = p - Dl, D2 [1] = p - D2 £ ff^t ITRA 
MlC^^S (*-ry:/1403) o Dl[l], D2[l]tt, -etl^tU &plC;*f £ Dl, 
D2cD,Kif£'fiiT*&£o #CtC2o (2fcTyh) <JDft«v, w(v, ^tCOXttl) £|g 

£fS (^.^^^1404) „ #CfC, X-ry-?1403T*&tot=.'T-'7Jlfrb* Dl [v] , 
D2[v] ffitt, mW-ffl&tm : h = Dl[v]*D2[v] mod p £ Hff 1/ T *S:9I & R 

AMfCftlft-r* (^-^^^1405) . D1[1]*D2[1] mod p = (p - Dl)*(p 

- D2) mod p = D1*D2 mod pT? 7.7- v :/1405<Djj£7BHC tt, v = 0, 1 
^"f *l T'*k lELVNh^^:^-2> 0 r^tC^-r- y^l406, 14071CT, x3&;£#) 
, ^X-fcRAMlC^Mt-So ^-ry ^"1408JCT, D3 = (x - x3) mod pfcltHf 
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Z(Dd3£. 5felC/SV^MC*f It, -T-->Ol/h[0] = h, D3 [0] = D3, 
h[l] = P ~ h, D3[l] = p - DS&^&TRAMlC&M-TS (^7^^1409) „ h 

[i], D3[im, -zti^n, mvizft-tzK d3a>}xm.mx*$>z> a &tc, *x 

UOQT'&tbfcT-^Jlfrb. h[v], D3[v] £JfcUmUT, ^Wll^ft^t : h [w] *D 
3[w] mod pSrUfi 1 ITlS^&R AMtC^f -5 (*5^y :/1410) 0 m5\ h [1] 
*D3[1] mod p = (p - h)*(p - D3) mod p = h*D3 mod pT*$>Z>(DT*> ^-r^^H 

io(Dmrmzit. » = o, i^-rncom^v^, sEL^m^t.^. *tfeic ^ 

^>yyi41HCT, y3 = (y3 - y) mod P £j£#)T R AMfC&^-T 3 „ ZLJlT*, 2P 
[0 0 6 9] 

5gn - ? tj y £#JM f 7 ^ - tf)/J^3I £ *rjffl ^ -5 =fc (D X % 

Z>o t&mz--? V y KSfifcSjTJ.W:, : 2*y*Dl + p*U = l£(2*y£;p(Z) 

GD/hJtS, "T p£ 2 v^cltfciE U s(p-l) mod P = 

»;&o££;fre>, g"(-l) mod p = g"(p-2) mod pi: Z. £ £M V*<5 t)©t 

. Dl = (2*y)"(p-2) mod p£ LT> Dl CD t^So 7x^7- 

e> o v - v mm e» -r r t % s „_ 

[0 0 7 0] 

MZ^1r 0 fi*T, «Rffi»±©j^P=(xl, yl), Q=(x2, y2)©fBP+Q<Bjgg«&(x 
3, y3)£:U P-«H>T?fcV^©£: Hi 6 ttGF(p)i:T'CDff ReME: y'2 = 

x"3 + ax + bK.&ft&j&P£Q<Dfa<DttMK&ftm&&FBls1L%<DV&& a 
[0 0 7 1 ] 

^ff^ns^a (^^^yisoi) tcr, Pi:Q^-^cLTVA§^^e)*^wst--5 
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izm&WZ-Z>) . J^T> P£Q#— StUT^fcV^'&CD&SS:^?-. ^-r-y^l502 
}C£^T, Dl = (x2 - xl)*(-l) mod pSffflfTS. #ClC, J*-r y ^1503(CT, D 
2 = (y2 - yl) mod p&tm^S. £*l£Dl, D2SC*fUT, - 7 fl/Dl [0] = Dl 
, D2[0] = D2, Dl[l] = p - Dl, D2[l] = p - D2£ffltUT R AMCMf§ 

(*iry:/1504) 0 Dl[l], D2[l]tt, SSptC^fSDl, D2(2&i&tit 

•e&S. tfCtCHo (2tf>y h) ©gLf&v, w(v, w«, #lC0Xttl)&38£f& (X 
-71505) „ X^^^1504-e^fefc^-^;V^^, Dl [v] , D2[v]£Ifc 

UffiLT, m#^ft# : h = Dl [v] *D2 [v] nod P ?:^l*C^^R AMCI& 
3W^*S (^-r-V 71506) „ ^Zl-e, D1[1]*D2[1] mod p = (p - Dl)*(p - D2) mo 
d p = D1*D2 mod pX*fo£<DT\ Xrr V 7 1506(D$&T$f\Z v = 0, lV>-f*l<£> 
IS-^Tf^v iEL^htf?$L$.Z >0 mZT.'rV 71501, 15091CT, x3 ^£R 
AMfC&MfSo ^-T-y^l509lCT, D3 = (xl - x3) mod p&ffjSf #ClC 
i©D3i:, ?£fCJ5V^Mc*f LT. ^-^Vbh[0] = h, D3 [0] = D3, h [1] = p- 

h, D3[l] = p - d3Z$tl!bTRAMlZfeffiT?Z> (Xf V 3/1510) „ h [1] , D3 [1 
]fcL i£ptC*f"r£h, D30Sife^5. #C»C, X^^^1510T^i?) 

tz.7"-7tofrh. h[w], D3[w] &Ifc*JffiLT, SSgJHjfctm : h[w]*D3[w] mod p 
ltlS*l:RAM(C|gitS (*-^>y^l511) . ^Z1T% h [1] *D3 [1] mod 

p = (p - h)*(p - D3) mod p = h*D3 mod p"e& & ' 7l511<Dt&~79% 

jcii, w = o, lv^-fti©^-?**, ZEbvN-fg^^^^o jfttftjc, * -5^:71512 

ICT, y3 = (y3 - yl) mod p&^fibT R AMlC&M1-£ = itlT?, P+Q©#&« 
[0 0 7 2] 

Sl6ffii», ^(C^nr#:GF(p"n)(p^iSr, nfcJ:H©ig») 
l>Ih^t'§5. ^tCi^^^itJlC, GF(p"nm, GF(p)ffi«0#]S5££##o < 
SSI (#^^SIt) GF(p) [X] ©GF(p)jC£tt£®e,ftj#^5£$ (X) (reduction polyno 
mial^pgHitl-Sr £%&£) O-f&Tn^^^JER-t**^ ^7^/ (prime ideal) ( 
*(X)) JCkSSflj^SR (quotient ring)GF(p) [x] /(* (X)) i: IHM (homomorphic) T 
tf»«"rtt, GF(p) [x]/($(X))iLtm$tl6. * ©MBSrH^f tS{C 
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&fc»J, A(X), B(X)£GF( P ) [X] ©5n GF( P )«ttf)#^) il-f^i: 

, GF(p) [X]/(*(X))T?©«*tt. 

Oftl) (A(X) + B(X)} mod * (X) 

(80 A(X)*B(X) mod « (X) 
£fcJ:oTll^t-£i£:#T££ 0 <BU mod P T^fe> 

o 

[0 0 7 3] 

H#J£^-f= H&P = 5, n = 2£L, reduction polynomial *(X)&X"2 + X 
+ lfc-rs. $(x)Mt&sriil *(0) = 1, *(1) =3, *(2) = 7 
= 2(mod 5), *(3) = 13 = 3(mod 5), * (4) = 21 = l(mod 5)1;$>2>Z.£ 
frbir<*lZ$-fr2> 0 A(X) = 4X"2 + 3X + 2, B(X) = 3X*2 + 4X + lft^t. 
Z(D. ZlO©#^(DGF(5) [X]/(X"2+X+l)tC^^SfPi:att, 
(fO) (A(X) + B(X)} mod * (X) 
= 7X"2 + 7X + 3 

= 2X"2 + 2X +3 mod 5T*ftlO 

OK) A(X)*B(X) mod $(X) 

= (4X"2 + 3X + 2)*(3X"2 + 4X + 1) mod (X"2 + X + 1) 

= 12X"4 + 25X"3 + 22X"2 + 11X .+ 2 mod (X"2 + X + 1) 

= 2X"4 + 2X"2 + X + 2 mod (X"2 + X + 1) &mod5-eff 3f) 

= X 

[0 0 7 4] 

*»P^3©S-^S:#A.S„ 3<Z)££, ^T©«P!ffi^li, E: y'2 = x"3 + ax 
+ b©jglc3Egn*£&o d;fl,£Weierstrass<Z)^p7££IJ^ 0 lit, E±<D&<D 
Jffi«©#^tt, GF(p A n)tf)^T*3b£<Z)T% A(X), B(X) &GF(p) [X] / (<D(X)) © 
TCtbt, (A(X), B(X))©J:^tC*3K"r«z:i:A«T?SS 0 
[0 0 7 5] 

J^T, P = (A(X), B(X))02#ffiWC^T©^J6W&j3*"r. fP©tf*tt, GF 
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[0 0 7 6] 

HIl 7 K2mft$f.<D&mffl&&'t. X-ry7l601&C;}3^T, Dl (X) = (2*B(X)) 
"(-1) mod fcCX^ff-irr*. #C£, X-r" v y^l602lCT, D2 (X) = (3*A(X)"2+a) 

mod $(X)5:ftlt5. ZUx&Dl, D2{C^fL/T, >Ol/Dl [0] (X) = D1(X), D 
2[0] = D2(X), Dl[l] (X) = $ (X) - D1(X), D2 [1] (X) = $ (X) - D2(X)£ff 
DtLTRAMlCftiWftS (^^^^1603) „ D1[1](X), D2'tl] (X)t±. 
i£*(X)tC^i-SDl(X), D2(X)<DHjfM-e&£„ #CtC2o (2fcfy M ©SLIfcv, 
w(v, wl±, #tC03ttel)&38£"*.5 7^:71604) . &tC, *7^y :/1603T^ 
tofc-T-ZfJlfrb. Dl[v](X), D2[v] (X)&fl5t»JtfJLT, §fe#S!ljk#f3¥ : h(X) = 
Dl [v] (X)*D2[v] (X) mod * (X) £H?T bTM^Hfc R AM{C*&M^6 (X^^/^160 
5) Ci iiT*, Dl [1] (X)*D2[1] (X) mod d> (X) = (<D(X) - Dl (X))«(* (X) -D2(X 
)) mod 3> (X) = D1(X)*D2(X) mod 4> (X) T?& -5 CD T% Xf y :/1605<Z>,1$TBHC & 
, v = 0, lV^tl iELV^h(X)*«#*5. ^{CX^^yi606, 1607 

&CT, A3(X) ^&RAMlC|&itS 0 y yi608JCT, D3(X) = (A( 

X) - A3(X)) mod $(X)^!fitS„ #clC, * ©D3(X) £:5fcfCM V^h(X) fC^tf LT 
> ^-^;Vh[0](X) = h(X), D3[0](X) = D3(X), h [1] (X) = $ (X) h(X), D3 [ 
1] (X) = <D(X) -D3(X)S:^i!)tRAMICft«|t5 y ^1609) „ h[l](X), 

D3[l](X)tt, -etl^tl, (X)fC*ff£h(X), D3(X)tf)M4£ffi #ClC, 

yi609T*#&fc^-:/;i/fr<b, h[w](X), D3[w] (X)&IRyffiLT, fftUCJW 
5&ftJ| : h[«] (X)*D3[w] (X) mod * (X) S:^LTj|g*S:RAMtC«j»irs (*t=- 
^^1610) „ ZZX% h[l] (X)*D3[1] (X) mod <D (X) = (<D(X) - h(X))*(4> (X) 

- D3(X)) mod d>(X) = h(X)*D3(X) mod <J> (X)T'&£C7)T% y ^"1610© j»T 

RHCtt, w = 0, lVNT*lCE>t§-£T*%, iEL/V^««#*S 0 *^(C, * 5=^:7161 
B3(X) = (B3(X) - B(X)) mod <I> (X) £;£#)T R AM}C&8ft-r<5 = ZLtlT* 

[0 0 7 7] 
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£ = mm=L-^ U V KSB^^T^i, ^Jt^gzS : 2*B(X)*D1(X) + <D(X)*U(X) = 
l£(2*B(X)£<KX)<Z)S*^ifc£#&3lg# (^l- * y y £^U3g 
tlilt', $S:llllfttCDl(X)£:£&3:£&T*&£ 0 — 7 x^v-CD/J^S&JS 
7x)l/V-(Z>/.M£Jl,. -T&t)^, * (X)£2V^Ci?i&g(X)}C*fL 
, g(X) A (p"n-l) mod «D(X) = ltfjfc »j5£-3 i fc** g(X)*(-l) mod $ (X) = g( 
X)*(p"n-2) mod «D (X) J&Si t $rMV^S=b©T? o£U, D1(X) = (2*B(X 
))*(p'n-2) mod *(X)fcLt, D1(X) £ # #) 6 * © T* & £ „ 7 ^;I/V-(Z)/Jn^S 

[0 0 7 8] 

p = 2©«-a-©||]gfeM$:^^-rS 0 £*1*T?fcW:;g^3Pfi| 
^M^5„ rtlli, #n T#GF (2" n) & reduction polynomial 4> (X) £M V»TGF( 
2) [X] / ( $ (X) ) -0 JgTf^JSi U feIR, #3t3;<Z>«C#GF (2)Tf»SIil*>64f6% 
©T?&<5. GF(2){C£v^li, *9 : -£tt*t;ftl$fc'T?&S. tV^CDte, 
tt, -1 = liEfr&Tf&S. £.©£fcfre>#38l8©jffi©®— o-c&s, r^<D(x) 
T*(Z)Mifgj *«^iftl*h3&S^e>*ff**. GF(2) [X](D#^^A(X)©«^% 

-A(X) = A(X)£&£„ ioT, *(X)i:A(X)CDGF(2)JCfeW*i»^^t±, 0£|& 

#Kl$lCW:, <D(X), *(X)+A(X), A(X)jettfcfc*. rtf>*S££l@£;L 
T, p = 2©«-^©m6#!fS:^'t. 
[0 0 7 9] 

iitlt WeierstrassflUflJgE:y"2 + xy = x*3 + ax + b£|^o;jf P3ffiife§J£# 
E±©j&P = (A(X), B(X))fC;*fU 2P = (A3(X), B3(X)) h^S. MMM 

[0 0 8 0] 

A3(X) = (h(X)"2 + h(X) + a) mod $ (X) 
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B3(X) = (h(X)*(A(X) + A3(X)) + A3(X) + B(X)) mod * (X) 
3 h(X)tt, h (X) = (A(X)"2 + B(X))*A(X)*(-1) mod $ (X)fct*. 

[0 0 8 1 ] 

mi &\z2mm<D$mm*7j<^ a ^vzfuouz^x. di (x) = (acx))*( 

-1) mod <l>VL)Ztf$f.>t& a fciz. 7,^V^\102\ZX. D2 (X) = (A(X)"2+B(X)) 
mod 4>(X)£ifJf-r£o rtl^Dl (X) , D2 (X) &C*fLT, -y— ?>D1 [0] (X) = 
D1(X), D2[0](X) = D2(X), Dl [1] (X) = 4> (X) + D1(X), D2 [1] (X) = <D (X) 
+ D2(X) 5:ffIbtRAM{CMt5 (^T-y^"1703) . 7£tCCo (4lfyh) 
©SLifcv, w, i, j(v, w, i, jj±, ^TOXttl) (X^y :71704 
) . 7.'rv7nOZX*i$Ubt=.T-zf}\yfrh\ Dl[v](X), D2 [w] (X) & Ifc U ffi 

It, ffUISJ^ffll : h(X) = Dl [v] (X)*D2 [w] (X) mod <D (X) Sr^ff LT*g«S: R 
AMiC^|fii--2> (^^^^1705) „ 3 3t (<D (X)+D1(X)) *D2(X) mod 4> (X) = 
D1(X)*(<D (X)+D2(X)) mod $ (X) = ($(X) + Dl (X))*(4> (X) + D2(X)) mod $ (X 
) = D1(X)*D2(X) mod <D (X) T* & £ CD T% ^1705<Z)|^T^lC v, w = 0 

, 1<DE<DW}&T**j. IELV*h(X)#:£3;S. #CfCX^- y ^1706, 1707&CT, A3(X 
^^§:RAM{C=(i&M-r^ 0 *"T-y:7l708fCT, D3(X) = (A(X) + A3(X) 

) mod $ (x)£ftn-r£ 0 #c»c, ;i<z>D3(x)£?DicMv^h(x)}c*fbT, 7—7 ft 

h[0](X) = h(X), D3[0](X) = D3(X), h [1] (X) = $ (X) + h(X), D3 [1] (X) = 
4>(X) + D3(X) ^^i^XRAMlZ^m-r^ (Xt V 71709) . #UC ^.■f^^'170 
GTf^&fc^ h[i](X), D3[j] (X) &IR »J ffi IT, SBjMH&ff* : h [i 
] (X)*D3[j] (X) mod $(X)$:||ftbT^&RAMt:Mt5 (*-f y 71710) 
.. 'IT% (4>(X)+h(X)) *D3(X) mod O (X) = h(X)*(<I> (X)+D3(X)) mod $ (X) 
= (<D(X) + h(X))*(4>(X) + D3(X)) mod O (X) = h(X)*D3(X) mod $(X)l?S-5 
(DX% ^-r-y^mOGDiWFT^fcW:, i, j = 0, l© !ELV>te# 
S^fC, ^"r-^^1711lCT, B3(X) = (B3(X)+A3(X)+B(X)) mod <D (X) % 

[0 0 8 2] 
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So S2*i-* y y KSRfcSj-eHu : A(X)*D1(X) + <&(X)*U(X) = 1 

S:(A(X)i:<D(X)<0«^»li»«:#«)«»^ (iL-*Uy KSBfciS) &»*;5g"tr 
J§^WJCDl(X)S:#a>***6"e&<S. 7x;i/7-ffl/J^15:M^6 

7i^7-ffl^I, *(X)fc:£VWCiltfcg(X)K2!fU g(X 

)"(2 A n-l) mod cD(X) = l^»JfioIt^f>, *(X)"(-1) mod * (X) = g(X)"(2 
*n-2) mod <t>a)£ft£Z£$:m^2>. : &(bT*&Z> 0 o*»J, D1(X) = (A(X)) " (2*n 
-2) mod <D(X)i:LT, D1(X) &:&*b.6 tiCDTf&S. ^xTW-CD/hJtS&JS^S 

[0 0 8 3] 

[0 0 8 4] 

01 9ti, GF(p)_t<Z)fimffi*8E: y"2 = x*3 + ax + b±cD^P = (x, y)(D2fe 
tf»lC*»9!&aMLfe-t>CD-e*>S. JSAT» 2P = (x3, y3)ht--5= * -5^:718 
OltCfc^T, Dl = (2*y)*(-l) mod p£ffH1-£ 0 V ^1802{CT> D2 

= (3*x"2 + a) mod p&ffHt-r*. D2{C^fUT, -5^- >Ol/D2 [0] = D2, D2 [1] = p 
- D2£ff|fLT RAM fd&M-TS 71803) 0 D2 [1] tt, &plC#f"?-3D2 

fflSiit'feS, 7&{C2o (2 try h) OSLI^v, w(v, wtt, £acOXtel)&#g£ 
(^^^^1804) . ^■5 t y^ , 1803T#«bfe'r-^;i/^e), D2[v]£5{ 

yffiL/T, *#«fj^ff»: h = Dl*D2[v] mod p^H^f bTM^Hfc R AMiCiit 
& (X^y ^1805) 0 lit', D1*D2[1] mod p J£, D1*D2 mod pT'&S£\ £ £ 

P - (D1*D2 mod p)T?*>y, 01 5 £ »J > ^1805^T 

B£*T*te, IELV^{C&£ fcteRg^J&V^ fclZ7>TV7l8Q6i 1807fCT, x3&;£ 
fx.5:RAM(CMt§ 0 ^1806tCfeV^T, h^modpT'2^ 

$;ft§£:#>, 7s7-V ^1805(DM^7b^ D1*D2 mod pTf&o.T *>, P " (D1*D2 mod 
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p)T?&oT*k !El^x3CE>fii#:£i; 5„ ^1808(CT, D3 = (x - x3) mod 

P%$iW--t2> a r^CtC r©D3(C*fLT, 5^-^;i/D3[0] = D3, D3[l] = p - D3& 
^^TRAMtCl&M-re (^^^^1809) o D3[l]&, &plC*ft £D3tf)jSif£flI"£ 
#ClC, ^5 i ^^ , 1809T^^^7 L -> r ;L/^e>> D3[w] ftLT, fitH^ 

#ft# : h*D3 [w] mod pfell^LT^&R AMC&M^S (Xf y ^1810) „ 
ZLZLTr, h*D3[l] mod p = h*(p - D3) mod p =p -(h*D3 mod p) T? & £ X 
"rv^l810(Dmy^Vlt. v = 0T?&*U£, h*D3 mod p, v = l^fetlli, P - (h 
*D3 mod p)£&oTV^„ ^^yyi811{CT, ^- :?>y3 [0] = y3, y3[l] = p 
- y3£]£#>TR AMfC^"TS 0 #CKI, (^.^^ ^1812) . ICT, v 

£wtf)#H&lftt&3SfD (exclusive OR) v EX0R wCDffitf, OX*$>Z>frlT*$>Z>fr 
U OT'&tUf, X5=-^-/1813iCii^, lX&tllt. *9-v7l8Ulzmtl 0 %mW 
mm%ti v EXOR wti, viiw^|BlCT'*)4xliO, M&4ltfl£&£ = l^oT, Sif&lft 

[0 0 8 5] 

S 0 fi£51^L— ^ U y FS^T'tt, ^Jg^SS; : 2*y*Dl + p*U = l£(2*y£p© 

©/Kj£3i,_ -r&*>*>, pfcswcsis&iE^ffiRgtc^u g*(p-i) mod P = 

yfioit^b, g"(-l) mod p = g"(p-2) mod p £ & £ Z £. £M V^ £ *)<D T'& £ 
„ o£*J, Dl = (2*y)"(p-2) modphLT, DlS:#«)S%(Z)T»&*. 7ijl/7- 

[0 0 8 6] 

#H«J£, HI 6.©||iiWJC«oTGF(p"n)©±G)flfP5ffii|»±02'f& 



3 8 
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mzmm-t £<&s 

[0 0 8 7] 

^BI^Bf #ii<z>tt$I £ *f e> ^ £ # Kit (c * & „ 

[mi] 

[02] 

[S3] 

[H4] 

#j®£;*1-0T*&£o 
[05] 

&3S#JilI£^ir0T'&3 o 
[06] 

[07] 

If P3 M±©M£ £ Mft0£ "t £ 0T*& £ „ 
[08] 

[09] 
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[BIO] 
[012] 

M^^^^^J^im(C*^0^^^MLfe«^©^2^^M^^S#JiB$:^ 
[013] 

^ > =r * u & & ffl v a & /< § mm& tm tc & l & « -a- <z>as 3 © ^im 
<d mm^ m & m -r 0 v & z „ 

[014] 

<£>#!.33¥JiH£^t-0 -C&S. 
[015] 

[01 6] 

^ai^jiR & ^ -r 0 7? & s o 

[017] 
[018] 
[019] 



4 0 
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906, 1005, 1106, 1207, 1304, 1404, 1604-*^ y ^ (JH^HEOjgiK) , 912—91 
5, 1012—1015, 1112—1115, 1213—1216, 1311 — 1314, 1405, 1410, 1605, 1610- ^-f 
V? CM1RWtem£mW) > 917,1017,1116,1217,1317- (SgJUCDfttlE) , 919- 
920,1019— 1020,1118— 1119,1219— 1220,1319— — V ^ (ffiMO&t)) 
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[mm*] 

[mi] 



r 



Vcc 
RST. 



102 



CLK-»=- 



— ^l/0 



101 



[H2] 



^201 



^202 



204 




206 
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2 
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[04] 
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y[0]=1 
y[1]=y 

y[2]=y~2 mod N 
y[3]=y~3 mod N 



s=1 



403 



'401 



'402 



404 



405 



406 



407 



408 








S=S"4 mod N 


> 


( No 



te, oofr * 



409 



S=S*y [0] mod N -l 




xCP&gjtf y h (ft fit ^s jfes^ 

te. oifr — *• 



410 



S=S*y[1] mod N 




411 



S=S*y [2] mod N 




tt, 11fr ^ 



412 



S=S*y[3] mod N 
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503 



y[2]=y~2 mod N 


y[3]=y"3 mod N 


> 


f 




=1 


I \ 





501 



502 



Yes 



506 
507 -\r 



> 


, No 


S=S~2 mod N 




\f 












> 







504 



505 



Yes 



508 



S=S~2 mod N 

I 



No 



Yes 



509 j*-^- . Yes 



S=S*y[2] mod N 



No 



S=S*y[3] mod N 



510 

■511 
— >■ 



4 
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CEI 6] 

m 6 




[H7] 

m 7 



, 1 1 1 1 


— i j i 




R 




i 


1 i i ■ i 


jP+Q 



5 
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8 



P[0]=O 
P[1]=P 
P[2]=2P 
P[3]=3P 



s= 


O 


>■ 


f 


S=2S£2[§]||?t 



.801 

-802 

✓803 
-804 







> > 





No 



< 



< 
< 



I 



I*. 01 A* 



I*. 10J&> 



< 



I*. 11 




6 
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[H9] 



903 



901 



S=R mod N v[0]=0, j=0 



y[0] [0]=R mod N 
y[1][0j=yR mod N 
y[2] [0]=y~2R mod N 
y[3] [0]=y~3R mod N 



904 



y[0][1]=N-(R mod N) 
y[1][1]=N-(yR mod N) 
y[2][1]=N-(y*2R mod N) 
y[3][1]=N-(y"3R mod N) 



905 r 



902 



Yes 



921 



J=j+1 



> 


, No 





I 



^906 
v[j]=0 or 1 
907 



S=S"2*fT(-1) mod N£2Hl3?fT 



< 



No 



908 



909 



912 



S=S*y[0] [v[j]]*R~(-1) mod N 



No ' 910 



913 



S=S*y[1][v[j]]*R*(-1) mod N 



No „ '911 



914 



S=S*y[2] [v[j]]*R"(-1) mod N 



915 



S=S*y[3] [v[j]]*R~(-1) mod N 



S=S*R"(-1) mod N 
T=N-S 



919 



Yes ^ " — " ««»^ no 

< <j ga<Pv=1fr J > > 



918 



■ 916 
917 

No 



920 
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1 0 



100: 



1001 



S=R mod N j=0 



y[1 
y[2 
y[3 





0 




0' 




:o: 




[0] 



=R mod N 
=yR mod N 
=y"2R mod H 
=y~3R mod N 



1004 



y[0][1]=N-(R mod N) 
y[1][1]=N-(yR mod N) 
y[2][1]=N-(y~2R mod N) 
y[3][1]=N-(y~3R mod N) 



1005 



| No 



1002 



Y • ^ — 



v=0 or 1 
•1006 



Yes 



021 



S=S~2*R" (-1) mod N£2|3]0Ht 



,1007 



^1008 

<Z x<pf vlT fl9M*OoW^ >-» 
No . -1009 



S=S*y[0] [v]*R~(-1) mod N 



012 



< ^ x<ot' v & ail 1*01 

No ^-1010 



S=S*y[1]M*R"(-1) mod N 



013 



No ^ ^101 1 



^014 



S=S*y[2] M*R~(-1) mod N 



S=S*y[3] [v]*R~(-1) mod N 



015 



S=S*R~(-1) mod N 
T=N-S 



1019 



T£tti2l 



Yes 



< 



'1018 



-1016 
-1017 

No 



-1020 



8 



2001-3066032 



#2001—060223 



[mil] 



1 1 



1103 



1101 



S=1 v[O]=0,j=0 



y[0][0]=1 
y [1] [0]=y mod N 
y[2] [0]=y~2 mod N 
y[3] [0]=y~3 mod N 



.1104 



y[0] [1]=N-1 
ytiHl]=*My mod M) 
y[2] [1]=N-(y~2 mod N) 
y[3] [1]=N- (y'3 mod N) 



1105 



1102 



Yes 



1120 



j=j+1 





, No 





I 



1106 
v[j]=0 or 1 
^1107 



S=S"2 mod N£2|g]3l?T 



'1108 



-1112 



No ^^1109 



S=S*y[0][v[j]] mod N 



Ino ^ -1110 
No '1111 



S=S*y[1] [v[j]] mod N 



1113 



■1114 



S=S*y[2] [v[j]] mod N 



1115 



S=S*y[3][v[jJ] mod N 



T=N-S 



1118 



Yes ^ " no 



-1116 



1117 



No 



-1119 



9 
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[012] 



1 2 



1201 



S=1 v[0]=0.j=0 



1204 



•1202 



asaw[k]3g£(k=o, 1.2,3) 



y[0][0]=1 

y[1][0]=y mod N 
y[2][0]=y~2 mod N 
y[3][0]=y*3 mod N 



0<w[k]<MAX 120g 



y[0][1]=w[0]*N-1 
y[1][1]=w[1]*N-(y mod N) 
y[2][1]=w[2]*N-(y~2 mod N) 
y[3][1]=w[3]4N-(y~3 mod N) 



'1203 



1206 



Yes 



-1221 



j=j+1 





f No 





I 



.1207 
v[j]=0 or 1 
1208 



S=S~2 mod N£20g|?T 



^ -1209 

_^1210 



213 



S=S*y[0][v[j]] mod N 



No 



< C <<Pt* W P^ttoi^ 



^ No ^^ -1211 

<C lx<Pt^^7•n7»tt^o»^ >^-^ , 
No ^1212 



^1214 



S=S*y[1][v[j]] mod N 



< 



-=-1215 



S=S*y[2][v[j]] mod N 



S=S*y[3] [v[j]] mod N 



216 



T=N-S 



1219 



<^< d M<M» ^ "^" H sgflft | 



-1217 



1218 



No 



-1220 



10 
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[013] 



1 3 



S=R mod N v[0]=0 j=0 



1301 



y[0]=R mod N 
y[1]=yR mod N 
y[2]=y~2R mod N 
y [3]=y"3R mod N 



1303 



1302 



Yes 



■1315 



j=j+1 



No 



1304 

v[j]=0 or 1 
1305 



S=S"2*R':(-1) mod N£2|E]3tfT 



s[o]=s 

S[1]=N-S 



1306 



No 



'1307 



.1308 



A 311 



S=S[v[j]]*y[0]*R~(-1) mod N 



No „ -1309 



S=S[v[j]]*y[1]*R~(-1) mod N 



1312 



< T x<Pb5y HdMOfr 

v No ^ ✓l 31 0 



S=S[v[j]]*y[2]*R~(-1) mod N 



•1313 



S=S[v[j]]*y[3]*R*(-1) mod N 



1314 



1 1 
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[HI 4] 



1 4 



S=S*R~(-1> mod N 



0316 



T=W-S 



1319 



Yes no 

«><0v=i» ^^^1 320 



-1317 



1318 



No 
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CHI 5] 



1 5 



D1=(2*yK(-1) mod p^*«>rRAM(Cft$A 



1401 



D2=(3*x~2+a)mod p£#«>TRAMf::«rfrt 



1402 



01 [0]=D1,D2[0]=D2 

D1 [1]=p-D1, D2[1]=p-D2 



1404 



1403 



v, w=0 or 1 



h=D1[v]*D2[v] mod p£-4ttf>"CRAM(C&$A 



x3=h"2 mod p£#*!>TRAM|Ct&|ft 



x3=(x3-2*x) mod p£3fttt-CRAMKtelA 



D3=(x-x3) mod p£3fctf)TRAMI-t&$ft 



1405 
1406 
1407 
1408 



h[0]=h,D3t0]=D3 
h[1]=p-h,D3[1]=p-D3 



4409 



y3=h[w]*D3[w] mod p£#tf>TRAMC:teftlj 



y3=(y3-y) mod p^JfrteTRAftHrtSffl 



1410 
1411 
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[SI 6] 



1 6 



01 5 CD 



Yes 



•1501 



P=Qfr? 
No 



> 



D1 = (x2-x1 )"(-!) mod p£jfcirjTRAM(::$&$A 



D2=(y2-y1) mod p^tftoTRAMClf&fft 



•1502 



1503 



D1 [0]=D1.D2[0]=D2 

D1 [1]=p-D1.02[1]=p-D2 



1505 



1504 



y v, w=0 or 1 



h=D1 [v]*D2[v] mod p^JfcttTRAMl-telfl 



x3=h~2 mod p^3|tto-CRAM(Z»|fl 



x3=(x3-x1-x2) mod p^H/ttbX RMiZt^i 



D3=(x1-x3) mod p^Jfc&TRAMlCf&IA 



1^1506 
1507 

1 ^1508 

^/1509 



h[0]=h. D3[0]=03 
h[1]=p-h.D3[1]=p-D3 



1510 



y3=h[w]*D3[w] mod 3ft 46 TRAM I 



y3=(y3-y1) mod p£#tf)TRAM(c1&jfl 



,1511 
1512 
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1 7 



D1 (X) = (2*B(X))"(-1) mod 4> 00 £##>TRAM|::1&& 



D2(X)=(3*A(X)*2+a) mod <f> (X) $*»TRAHHC»|ft 



1601 



1602 



D1 [0] (X) =D1 (X) . D2 [0] 00 =D2 GO 

D1[1] 00 = * 00-D100.D2[1] 00 = *- 00-D2(X) 

^3R«)"CRAM|CtS«i 



1603 



1604 ' 



v, w=0 or 1 



h (X)=D1 [v] 00 *D2[v] (X) mod 0 (X) £#ftTRAM|::t&fft 



1605 



A300=hOQ*2 mod <f> 00 ATRAM(Cftfft 



A3 (X) = (A3 (X) -2*A (x) ) mod <t> (X) **ttT RAM|z4§|ft 



1606 

1607 
1608 



D3(X) = (A(X)-A300) mod <f> 00 £#«)TRAMI-f&|A 



h [0] 00 =h (X) . D3 [0] 00 =03 (X) 

h [1 ] 00 = 4> (X) -h 00 . D3 [1 ] 00 = * 00 -D3 00 

£#ft-CRAMKl&lfi 



,1609 



B3(X)=h[w] 00*03 [w] (X) mod * (X) ^*toTRAM[=»tfl 



B3 00 = (B3(X)-B00) mod 0 (X) £3|ttf>TRAMl3t§$i»i 



.1610 



1611 



2001-3066032 



#2001—060223 



[Ell 8] 



m is 



D1(X) = (A(X>rH) mod d> 00 £ 3jt«>TRAMl::tft$|l| 



D200 = (AOO~2+B00) mod * 00 ^JfctoTRAMlCf&tt 



1701 
1702 



01 [0] 00 =D1 (X) , D2 [0] (X) =02 (x) 

D1[1] 00=<t> 00+01 (X),D2[1] 00 = * (X)+02(X) 

£#tf>TRAMt=fttft 



1704 



1703 



SLSJtv, w. i, j£r&£ 



v,w, i , j=0 or 1 



h(X)=D1[v] 00*02 [w] 00 mod <t> 00 $>&tbXRM\ZtgMl 



A3 00 =h 00 "2 mod 00 £#tt"CRAMI::t&|iA 



1^ 



1705 



1706 



A3 00 = (A3 00 -Hi 00 +a) mod <f> 00 ^*tt"CRAM|C<S|fl 



1707 



J 708 



D3(X) = (A0O+A3 0O) mod * 00 SJfctfjTRAMlCt&ft*! 



h [0] 00 =h (X) , 03 [0] (X) =03 00 

h{1] (X) = « 00+h(X),D3[1] 00 = 0 00+D3 00 

$*to-CRAMJ=tfi« 



4709 



B3(X)=h[i] 00*03 [j] 00 mod tf> (X) &HttoXlUMlZ%to 



1710 



B3 00 = (B3(X)+A3(X)+B00) mod 0 (X) £#4&-CRAM|::f&fft 



1^ 



1711 



1 6 
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[019 3 



1 9 



D1 = 


(2* y r(-1) mod p£#ft>TRAMI 




D2= 


= (3*x~2+a) mod % 










> 










D2[0]=D2,D2[1]=p-D2 
















1804 










v, w=0 




> 


f 






h=D1*D2[v] mod p£##>TRAM|Cf&$fl 




x3 


=h~2 mod p£#toTRAM(C*&$ft 


x3= 


(x3-2*x) mod p£#toTRAM{cl§$fi 


D3=(x-x3) mod p£3ftto"CRAM!::te$A 



✓1801 
✓1802 



1803 



1805 
1806 
1807 
1808 



D3[0]=D3,D3[1]=p-03 



1809 



y3=h*D3[w] mod p^*46TRAMlC*&$l>J 



,1810 



y3[0]=y3. y3[l]=p-y3 



,1811 



,1812 
No 



Yes 



813 



y3=(y3[0]-y) mod p£ JfcibTRAMKl&fft 



,1814 



y3=(y3[1]-y) mod p£jfc«)-CRAM(Ct&& 
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